Privacy Act | Speechies in Business

Reputable cloud-based practice management systems, like Cliniko and HealthKit, are becoming more sophisticated. Many Australian SLPs in private practice are using them to store client progress notes.

I’m all for using systems to save time and money. And it’s hard to ignore the (as yet, unrealised) dream of a paperless clinic. But if you are using or planning to use a practice management system to store progress notes online, it’s best to be aware of some of the legal risks, if only so you can think about how best to manage them.

First, it’s worth recapping some key laws that regulate speech pathologists’ progress notes in Australia.

1. Do we need to keep progress notes?

Yes.

In most Australian States, there is a legal requirement to take progress notes. For example, under the NSW Code of Conduct for Unregistered Health Practitioners, we “must maintain accurate, legible and contemporaneous clinical records for each client consultation”. For States and Territories who have not yet implemented the National Code, there is still an ethical requirement (see clause 3.3.6 of the Speech Pathology Australia Code of Ethics).

2. Who owns progress notes?

Generally, as a matter of law, principal speech pathologists own their file notes. Sole practitioners have full ownership of their notes. Employers own the progress notes of their employed speech pathologists. In most cases, the hirer/principal owns progress notes relating to clients served by independent contractors (although this is a bit of grey area and should be documented in the contract between the hirer and the independent contractor).

In group practices, and practices with a high turnover off staff, the analysis of who owns a specific progress note (and who owes legal obligations to retain and protect it) can get complicated quickly.

3. Who, apart from the speech pathologist, has access rights to progress notes?

Clients have statutory access rights to progress, including under the Privacy Act 1988 (Cth) (“Privacy Act”).

Progress notes can also be subpoenaed by a party to litigation, e.g. in Family Court custody disputes or where there is an allegation of professional negligence.

4. For how long do speech pathologists need to keep progress notes?

This varies, State by State. But it’s longer than many people think. In NSW, the ACT, and Victoria, for example, you are required to keep progress notes until a child client turns 25, and, for adults, for seven years from the date of the last service.

You may also need to keep progress notes in some States if you anticipate litigation.

5. What are speech pathologists’ key privacy obligations with respect to progress notes?

For the purposes of the Privacy Act:

speech pathologists in private practice – big or small – are “health service providers”; and
our file notes and reports contain “health information”, which is one of the most sensitive categories of personal information.

This means that, compared to non-health related small businesses, we need to take extra steps to protect our clients’ privacy.

First, we need consent to collect health information. We also need to tell clients how we handle their information, including how we will store and protect it. The most common way of doing this is through a privacy policy and a written notice at or just after intake.

Speech pathologists must take reasonable steps to protect personal information from misuse, interference or loss; and from unauthorised access, modification or disclosure. If we are sending personal information offshore, we must take reasonable steps to ensure no privacy breaches will occur.

Since 22 February 2018, the Privacy Act has imposed a mandatory breach notification requirement on health providers for some data breaches, including breaches that health providers believe are likely to result in serious harm to patients. (You can read more about this here.)

6. Progress notes stored in practice management systems

The laws above apply regardless of how you write progress notes or where you store them. Storing progress notes in a cloud-based practice management system raises a few additional issues speech pathologists need to think about.

To help make the discussion as practical as possible, I looked at the Cliniko and HealthKit Terms of Use as of 9 July 2018. I don’t currently use either service in my practice, but I know both are reputable services used by many speech pathologists.

(a) Who is responsible for complying with Australian laws that regulate progress notes stored on practice management systems?

The speech pathologist.

Health service providers, including speech pathologists, cannot delegate their legal obligations to service providers. Most practice management system companies make this very clear in their terms of use. For example:

Cliniko’s terms state that the speech pathologist using the service “must comply with all applicable rules and regulations, including without limitation privacy laws, and must not infringe or violate third party rights”; and
HealthKit’s terms state that a speech pathologist using the service warrants that they “manage Personal Information in accordance with Australian Privacy Principles….”.

(b) Does the speech pathologist still own their notes?

Probably, though it’s best to check before using a practice management system to store progress notes. For example, Cliniko expressly claims no intellectual property rights over the data or other material speech pathologists provide. HealthKit’s Terms of Use appear to be silent on this point.

(c) Do you need client consent to store progress notes in a cloud-based practice management system?

In our view, yes. And, in their terms, some providers appear to agree with us.

For example, HealthKit’s terms state that speech pathologists using the service must warrant (promise) that they “have disclosed to and obtained the consent of patients that their personal and non-personal data, including health records and payments information, are stored on [HealthKit]…[and] further warrant that [they] have disclosed and obtained patients’ consent for the possible uses of the information stored on this site”. HealthKit’s terms go on to state that speech pathologists using the site warrant that, “where in your reasonable belief the patient is physically or mentally incapable of consent, you have disclosed and obtained the consent of the patient’s guardian, next of kin or other relevant party”.

(d) What happens if the practice management system loses or deletes your progress notes, goes down, if your service is suspended or terminated, if the provider goes out of business, or if the service is otherwise discontinued?

The speech pathologist remains on the hook for the privacy, health record retention and other obligations in respect of progress notes. Even if the management system deletes or otherwise loses your data.

Most practice management system companies are very clear on this. For example:

the Cliniko terms provide that use of their service is at the speech pathologist’s sole risk and that the speech pathologist is solely responsible for any damage resulting from use of their service; and that the entire risk arising out of use, security or performance of their service remains with the speech pathologist. They also make it clear that if there is loss or damage to your data, your only remedy will be for the company to “use reasonable commercial endeavours to restore the lost or damaged data from the latest back-up of such data” maintained by the company. They also make it clear that they do not promise to provide an uninterrupted or error free service.
the HealthKit terms provide that the service is provided on an “as is” and “as available” basis and that they may (among other things) “discontinue this web site and its services or delete the data you provide, whether temporarily or permanently”.

(e) With whom can the practice management system company share progress notes containing health information?

This varies from company to company. For example:

the HealthKit terms state that “sometimes we may transfer information to persons outside Australia (e.g. a contractor located in another country who provides us with services). By giving us your personal information, you consent to such disclosures”. They also state that they can share information with Medicare, the Department of Veterans’ Affairs and “our SMS provider and other third parties that we contract or with whom we integrate for the for the purpose of identifying you”.
the Cliniko terms state that users consent to the company “transferring your data to third party IT providers, including our website host and back-up service provider, outside Australia”. Cliniko’s Privacy Policy states that their use of data that is personal information relating to third parties (including clients) is limited to providing support and technical assistance.

In practice, this means you need to look carefully at the specific provider’s terms of use and privacy policy. In particular, you need to check that the service provider does not claim the right to use your clients’ data for direct marketing, or to sell it to third parties for commercial purposes.

(f) What happens if the practice management provider suffers a data breach involving your progress notes?

The speech pathologist is responsible to their clients and the regulator for compliance with the Privacy Act, including the mandatory notification requirements for serious breaches. To do this – obviously – you need to know that a breach has occurred and speech pathologists should check that their service provider will notify them in a timely fashion that a data breach has occurred. Cliniko, for example, states in their Privacy Policy that they will notify users within 72 hours of discovering a breach.

Bottom line

Storing progress notes on a cloud-based practice management system is an attractive proposition for many speech pathologists. Storing progress notes in the cloud raises compliance issues, including with respect to client privacy and the retention of health records. Regardless of how speech pathologists write and store their progress notes, they are responsible for complying with Australian laws that apply to the creation, storage, use and disclosure of health records.

Disclaimer: The information in this article is for general information purposes only and is not legal advice. This article is current as at the date of its publication. This article does not constitute any kind of legal advice, opinion or recommendation about rights, obligations, remedies, defences, options, or strategies. It cannot be relied on by any person for any purpose. If this article raises any issues for your practice, you should seek independent legal advice based on the facts and circumstances of your situation.

Related articles:

Image: httpss://tinyurl.com/yczh39uq